1. Statement of the Technical Field
The present invention relates to federated identity management, and more particularly to brokering federated identities in a computer communications network.
2. Description of the Related Art
Logical services such as Web services represent the leading edge of distributed computing and are viewed as the foundation for developing a truly universal model for supporting the rapid development of component-based applications over the World Wide Web. Web services are known in the art to include a stack of emerging standards that describe a service-oriented, component-based application architecture. Specifically, Web services are loosely coupled, reusable software components that semantically encapsulate discrete functionality and are distributed and programmatically accessible over standard Internet protocols.
Conceptually, Web services represent a model in which discrete tasks within processes are distributed widely throughout a value net. Notably, many industry experts consider the service-oriented Web services initiative to be the next evolutionary phase of the Internet. Typically, Web services can be defined by an interface such as the Web services definition language (WSDL), and can be implemented according to the interface, though the implementation details matter little so long as the implementation conforms to the Web services interface. Once a Web service has been implemented according to a corresponding interface, the implementation can be registered with a Web services registry, such as Universal Description, Discover and Integration (UDDI), as is well known in the art. Upon registration, the Web service can be accessed by a service requester through the use of any supporting messaging protocol, including for example, the simple object access protocol (SOAP).
Web services users typically can be known by multiple identities across multiple, secure, computing domains. In particular, each user can enjoy a unique identity within a particular secure domain which can differ from the identity enjoyed by the same user in a different secure domain. This multiplicity of identities for individual users can impede the ability of Web services in each secure domain to collaborate with one another in order to provide a higher level of function desirable to an end user or requesting process. Yet, it can be desirable to collaboratively arrange Web services in multiple secure domains so as to capitalize on the integration of information form the multiple different domains to form a cohesive application.
The notion of a federated identity can require the exchanging of identity information in the form of security credentials between different secure domains to provide a level of collaboration necessary to arrange Web services into a cohesive coputing application. Presently, a wide variety of credential forms are known to be available including Kerberos, X.509, LTPA and the like. Notably, when accessing a single Web service provider, the credential format can be manageable problem. In contrast, handling with credential formats and their associated trust relationships can become an acute and complex problem when attempting to federate an arbitrarily large set of Web services providers. Generally, a canonical form of credentials can suffice as the sole solution to the problem of federated identities. Notwithstanding, the use of a canonical form of credentials can become unwieldy for large sets of providers.